When a computer system is managed, a process of detecting a causative event among a plurality of failures or symptoms of failures sensed in the system is performed, as illustrated in, e.g., Patent Literature 1. More specifically, in Patent Literature 1, an event is generated from an excess of a performance value over a threshold value in a piece of equipment under the control, and pieces of information on events are accumulated in an event DB, using management software. The management software has an analysis engine for analyzing causal relationships between a plurality of failure events which have occurred in pieces of equipment under the control. The analysis engine accesses a configuration DB storing inventory information of each piece of equipment under the control, recognizes components of the piece of equipment on a path as an I/O path, and recognizes ones of the components which may affect the performance of a logical volume on a host as a group called a “topology.” If an event occurs, the analysis engine applies an analysis rule which is composed of a condition statement and an analysis result determined in advance to each topology to build an expansion rule. The expansion rule includes a cause event responsible for degradation in the performance of a different apparatus and a group of related events caused by the cause event. More specifically, an event described as the root cause of a failure in the THEN part of the rule is a cause event, and ones other than the cause event of events described in the IF part are related events.